The vulnerability identified as CVE-2026-72591 is a server-side request forgery (SSRF) issue in the gabehf/Koito project affecting versions up to and including 0.3.2. An authenticated user can exploit this by providing a specially crafted image_url parameter to the PATCH /apis/web/v1/album/{id}/image endpoint, causing the server to make HTTP requests to arbitrary hosts. This can lead to unauthorized access to internal resources or external systems via the server. The CVSS v3.1 score is 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), indicating network attack vector, low attack complexity, requiring privileges, no user interaction, scope changed, high confidentiality impact, no integrity or availability impact.

An attacker with authentication privileges can leverage this SSRF vulnerability to make the server send HTTP requests to arbitrary internal or external hosts. This can lead to unauthorized disclosure of sensitive information from internal systems or external services accessible by the server. The confidentiality impact is high, but integrity and availability are not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a fix is available, restrict authenticated user input for the image_url parameter and monitor for suspicious request patterns targeting internal or sensitive resources.